Module Name: src
Committed By: maxv
Date: Sun Aug 2 07:37:57 UTC 2015
Modified Files:
src/sys/compat/netbsd32: netbsd32_ioctl.c
Log Message:
Wrong logic. Here, userland can control the size and the data copied, which
basically means it can overflow kernel memory.
ok martin@ christos@
To generate a diff of this commit:
cvs rdiff -u -r1.81 -r1.82 src/sys/compat/netbsd32/netbsd32_ioctl.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/netbsd32/netbsd32_ioctl.c
diff -u src/sys/compat/netbsd32/netbsd32_ioctl.c:1.81 src/sys/compat/netbsd32/netbsd32_ioctl.c:1.82
--- src/sys/compat/netbsd32/netbsd32_ioctl.c:1.81 Mon Jun 1 16:07:27 2015
+++ src/sys/compat/netbsd32/netbsd32_ioctl.c Sun Aug 2 07:37:57 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: netbsd32_ioctl.c,v 1.81 2015/06/01 16:07:27 roy Exp $ */
+/* $NetBSD: netbsd32_ioctl.c,v 1.82 2015/08/02 07:37:57 maxv Exp $ */
/*
* Copyright (c) 1998, 2001 Matthew R. Green
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_ioctl.c,v 1.81 2015/06/01 16:07:27 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_ioctl.c,v 1.82 2015/08/02 07:37:57 maxv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -144,7 +144,7 @@ netbsd32_to_if_addrprefreq(const struct
strlcpy(ifap->ifap_name, ifap32->ifap_name, sizeof(ifap->ifap_name));
ifap->ifap_preference = ifap32->ifap_preference;
memcpy(&ifap->ifap_addr, &ifap32->ifap_addr,
- max(ifap32->ifap_addr.ss_len, _SS_MAXSIZE));
+ min(ifap32->ifap_addr.ss_len, _SS_MAXSIZE));
}
static inline void
@@ -547,7 +547,7 @@ netbsd32_from_if_addrprefreq(const struc
strlcpy(ifap32->ifap_name, ifap->ifap_name, sizeof(ifap32->ifap_name));
ifap32->ifap_preference = ifap->ifap_preference;
memcpy(&ifap32->ifap_addr, &ifap->ifap_addr,
- max(ifap->ifap_addr.ss_len, _SS_MAXSIZE));
+ min(ifap->ifap_addr.ss_len, _SS_MAXSIZE));
}
static inline void
